MFA

Type: MFA Provider Packages

Available Providers

Package	Method	Installation
@nauth-toolkit/mfa-totp	TOTP (Authenticator apps)	yarn add @nauth-toolkit/mfa-totp
@nauth-toolkit/mfa-sms	SMS codes	yarn add @nauth-toolkit/mfa-sms
@nauth-toolkit/mfa-email	Email codes	yarn add @nauth-toolkit/mfa-email
@nauth-toolkit/mfa-passkey	WebAuthn/FIDO2	yarn add @nauth-toolkit/mfa-passkey

Configuration

Option	Type	Default	Description
enabled	boolean	false	Enable MFA
enforcement	string	'OPTIONAL'	'OPTIONAL' | 'REQUIRED' | 'ADAPTIVE'
allowedMethods	MFAMethod[]	All	Allowed methods
issuer	string	App name	TOTP issuer name

Usage

NestJS

import { TOTPMFAModule } from '@nauth-toolkit/mfa-totp/nestjs';

@Module({
  imports: [
    AuthModule.forRoot({
      mfa: {
        enabled: true,
        enforcement: 'OPTIONAL',
        allowedMethods: [MFAMethod.TOTP, MFAMethod.SMS],
      },
    }),
    TOTPMFAModule,
  ],
})
export class AppModule {}

Express

const nauth = await NAuth.create({
  config: {
    mfa: {
      enabled: true,
      enforcement: 'OPTIONAL',
      allowedMethods: [MFAMethod.TOTP, MFAMethod.SMS],
      issuer: 'My App',
    },
  },
  dataSource,
  adapter: new ExpressAdapter(),
});

Fastify

const nauth = await NAuth.create({
  config: {
    mfa: {
      enabled: true,
      enforcement: 'OPTIONAL',
      allowedMethods: [MFAMethod.TOTP, MFAMethod.SMS],
      issuer: 'My App',
    },
  },
  dataSource,
  adapter: new FastifyAdapter(),
});

MFAMethod Enum

enum MFAMethod {
  TOTP = 'totp',
  SMS = 'sms',
  EMAIL = 'email',
  PASSKEY = 'passkey',
  BACKUP = 'backup',
}

IMFAProviderService Interface

interface IMFAProviderService {
  /** Unique method name for this provider (e.g., 'totp', 'sms', 'passkey') */
  readonly methodName: string;

  /** Check if this method is allowed by configuration */
  isMethodAllowed(): boolean;

  /** Initiate MFA setup. Returns provider-specific setup data. */
  setup(setupData?: unknown): Promise<unknown>;

  /** Verify setup and create MFA device. Returns device ID. */
  verifySetup(verificationData: unknown, deviceName?: string): Promise<number>;

  /** Verify MFA code/credential during authentication */
  verify(code: unknown, deviceId?: number): Promise<boolean>;

  /** Send challenge (SMS code, passkey options). Optional — not needed for TOTP. */
  sendChallenge?(challengeSessionId?: number): Promise<unknown>;

  /** Generate single-use backup recovery codes. Optional. */
  generateBackupCodes?(): Promise<string[]>;
}

Providers

• TOTP
• SMS
• Email
• Passkey